In this demonstration,
we're going to explore the different modules within Metasploit,
and in this case, we'll review the different outputs.
As we see here, we are in the Metasploit console,
so we'll want to explore some information about the modules.
So the first thing we'll review is the encoders.
The easiest way to do that is just the enter search encoders.
You see, we have lots of encoders.
Now we encourage you to explore the different ones,
and we'll get into ranking later of different modules.
So when you start looking at this, it's pretty basic when you see how it's done.
So all we have to do is use encoder, and then the type of encoder,
so we'll do an x64 encoder, and do an exclusive or.
Now, we'll clear the screen to get up to the top,
and like we do with everything, we'll do info to read about the module,
and a very simple module that does the exclusive or.
So they use an 8‑byte key and take advantage of the x64 relative addressing.
So this is just a mechanism to do an exclusive or.
Now you see there we've got the architecture,
the x64, All Platforms, and then Normal Rank,
and as I said, we'll get into actual ranking later.
So how exactly do these get stored within the Metasploit tool?
As you can imagine, it's in the directory structure.
So we have ls /usr/share/metasploit‑framework/modules,
and then we enter that, you see exactly what we have.
We have the auxiliary, we have the encoders,
we have evasion, our exploits, our nops,
our payloads, and our post, different types of modules.
And the first one will go into is the payloads.
Now when we're doing ls and our payloads,
you see we've got singles, stagers, and stages.
So now what we want to do is we want to take a look at one of those.
So if we do a cd into the singles folder,
and do an ls, now we've got the different platforms.
Remember, the target platforms are critical when it comes to our success.
So we've got Android, we've got the Apple iOS, and so on, so you see that.
So we'll stick with the Windows theme here, and we'll do cd windows.
Once we're in Windows, we'll do an ls, and look what you have there.
You have all these different payloads,
and the .rb means it's actually a Ruby script code.
So when we start looking at it, we see because these are singles,
and as a reminder, a single sends everything all as one stage,
if you will, right, non‑staged, they're not separate stages,
just one go, everything goes at one go.
So when you look here, we got the meterpreter, we got the PowerShell.
That means we're actually sending everything in as one.
So let's take a look at one here.
So we'll do a more shell_bind_tcp.rb.
This is the Ruby code.
As you see,
it starts right off with the headers information
that says it requires Metasploit.
Very important that we look at these and understand these before
we ever run these in a professional engagement.
We have to look at this code and make sure that it's not modified in
such a way that it could damage a client's network.
Also, we should look at it at the packet level.
What that means is we should, when we're doing this,
we should actually run a protocol analyzer and examine everything the
code does from an actual packet‑level standpoint.
But as you look through here, and we actually go down,
the big part right here is the payload, and that's the payload.
In this case, remember, it's a shell_bind_tcp.
So that's the payload we'll use when we actually run our exploit command.
Now since it's a single, this will all go as one,
as you'll see when we actually take a look at it.
If we look at this again,
we'll clear the screen to get up to the top so we can see it better here,
you see that all these payloads have underscores that separate.
So you have here right in the middle, meterpreter_reverse_http.
So that's a meterpreter_reverse_shell_http payload,
and we do our actual, you see, we got our singles,
our stagers, and our stages, so what exactly does that mean?
Well, what it means is we have the different actual stagers.
So if we go here, and we go cd into the stagers,
this goes as stages, and we go cd into windows,
you see here we have the payloads, we do not have the payload name,
we don't seem meterpreter, we don't see the shell,
the bind, all those types of things we saw before.
Let me clear the screen to get up to the top.
All we see here is the actual reverse, the type of shell,
reverse_tcp, reverse_https, right, those types of things.
So when start to thinking about that, where is the name then?
Let me go into cd windows, we'll clear to get at the top,
so when you look here, what do we have?
The stages are the type of payload.
You see here the meterpreter, you see here the the inject.rb,
right, which is a process inject, the p,
the portable executable informant.
You've got the actual vnc and the vncinject,
and you get the idea, so all of these, but within this,
if you do the cd x64, that's an actual directory.
Now you have specific x64 payloads, and as you may recall,
x64 payloads are required for some of our different exploits.
All right, so now, what we want to do, we want to walk through this process,
and to do that, we're going to actually target a vulnerable machine.
That's the whole process here is we target a vulnerable machine.
So we want to use a vulnerable machine that gives us a pretty
good chance of getting 100% exploitation.
So we're going to use an old Windows 7 machine just to prove our point.
And we have the famous weakness of the WannaCry ransomware on that machine.
So let us walk through the process.
What we're going to do is we're going to enter ms17010,
so let's do a search ms17, which is for the year,
010.
Now ms17 means it came out in 2017. As you see here, we
have quite a few different exploits there.
And when you look at the top one, it's just use 0.
We'll clear, and you see it defaulted to the actual payload,
but we don't really want to do that.
What we want to do is we're going to set our Rhost,
right, so remember if we do an info, there's the info,
the information about the exploit, and we won't read all of that,
but you see it's actually SMBv1, so you have to have 2 vectors for this to work.
You have to have port 4445 open, and you have to have SMBv1 enabled.
If SMBv1 is not enabled, the attack doesn't work,
right, I mean, and that was recommended best practices,
which again is not part of the scope here,
but it should have never been successful,
but we know it's successful all over the world,
so that's a problem.
So now if we do our show options, and we see our options,
and we see once again what's required, Rhosts,
and remember Rhost is our actual, as we said before,
target.
So we need to know the payload number.
We're going to a show payloads.
Load at all the different payloads,
right, there's lots of different listed on here.
The one we want is the one we were looking at.
So we'll use 36.
Sorry, set payload.
Now, being around for some time in doing this,
I always use uppercase when I set a variable and set an option.
It's not required anymore, you can do it with lowercase,
but it's just the way it always was when I did it.
You see what our payload is there?
It's our windows/x64/shell/bind_tcp.
That means it's a staged payload.
As you may recall, shell_bind_tcp would have been a single payload.
So now we clear it, and we get to the top.
So now we're ready to set our Rhost.
Now our Rhost is going to be the Windows 7 target.
So we've set our Rhost.
Now that we've got the target set, we're going to run the exploit.
Now remember, exploitation is not 100%,
but we'll at least experiment to see if we can get the exploit to fire.
Now we selected the ms17010,
which of course is the WannaCry ransomware vulnerability because
it's pretty close to 100%, but there's no guarantee. The rule of
thumb, just for your knowledge and your information, we usually
do this three times.
If we don't get the target in three times, we move on and try
different payloads, or a different vector,
a different method of attack.
So now all that remains is to run exploits. Likely vulnerable,
that's all good, that's what we like to see.
And now you see it's starting to send all the
actual information for the exploit.
See here, we've got a Windows 7 Professional 7601,
that's why it's a staged payload.
So it sends that small stage first and then sends, in this case, just
a regular bind_tcp, and you see the win, we won.
So if we actually look at and use the command netstat ‑an, you'll see
the connection right there, an established state.
All right, so everything's good there.
So now what we're going to do is background the session, clear to get up to
the top, and we're going to change the payload, right?
So our payload we want is payload 42.
So we do show payloads now, and there's 42.
So as you see there, there's an actual Windows, right, payload number 42
there, payload/windows/x64/shell_bind_tcp. So this is a single.
Remember, we just did a stager payload because we've
seen the stage sending the stage.
So now we'll clear to get up to the top, we'll set our payload as a
single payload, and now we've got the payload set with that
shell_bind_tcp, and now we hope we can exploit it twice.
Now some exploits are single fire.
That means you're only going to exploit them once, you're not going to be
able to exploit a second time. Luckily, this one is a multi‑fire exploit, so
hopefully we'll get another shell. But this time, look at the difference. So
the same thing, everything we had before, but now we're going to see there's
not going to be a stage.
So as you watch that output there, there won't be a stage, and
all of a sudden there it goes starting the handler, and
immediately it will go into the session.
See that, there's our win, and there's our session, and that's the difference
between the two. We saw, we had in the first example, we had a stage, so it
sent the stage, when it said it sent the stage, the next thing it did was, in
this case, the bind_tcp_shell, the stager.
Now in this case, since we did a single all as one,
it didn't actually send the stage,
it sent the actual stager and stage all together, and
that's why it's called a single.
And now if we go here and do a netstat ‑an, we see there's
both of our actual established connections.
Now, if you want to actually look at it a little bit better,
you can do and an, pipe it to findstr 4444,
which remember, you'd always want to change that if you're
actually doing this, and there's our 2 specific connections
and our shells on this machine.
And once again, we now have two shells on the machine, and what,
you'd probably say, well, what do you do with that, well,
sometimes you upgrade one to a meterpreter,
do different things like that, you might put in one different exploit session,
you might put in a keystroke logger,
you might dump password hashes, it really depends on the scope of work and
what you're trying to achieve, and that's part of the goal of the test,
and that's always determined ahead of time.
And with that,
we've accomplished what we wanted to in this demonstration,
and we'll conclude the demonstration here.